fix: keep Noise harness transport self-contained

Co-authored-by: Codex noreply@openai.com

codex-rs/exec-server/src/noise_relay/harness.rs

@@ -368,7 +368,9 @@ async fn receive_data(
     // implicit. A future or duplicate ciphertext passed directly to Clatter
     // would desynchronize the channel.
     for ciphertext in inbound_ciphertexts.push(data.seq, data.payload)? {
-        let plaintext = transport.decrypt(&ciphertext)?;
+        let plaintext = transport.decrypt(&ciphertext).map_err(|error| {
+            ExecServerError::Protocol(format!("Noise relay decryption failed: {error}"))
+        })?;
 
         // The authenticated byte stream can carry partial or multiple JSON-RPC
         // messages; emit only complete, successfully parsed messages.

codex-rs/exec-server/src/noise_relay/mod.rs

@@ -6,8 +6,6 @@ use tokio_tungstenite::tungstenite::protocol::WebSocketConfig;
 
 use crate::ExecServerError;
 
-pub(crate) use harness::noise_harness_connection_from_websocket;
-
 // This bounds allocation in tungstenite before protobuf and Noise record
 // validation run. It comfortably fits one maximum Noise record plus metadata.
 const MAX_NOISE_RELAY_WEBSOCKET_MESSAGE_SIZE: usize = 256 * 1024;